Zimbra Collaboration Suite zero-day under attack

Published August 20, 2026 CVE-2026-73570

Attackers are actively breaking into Zimbra email servers using a serious flaw that lets them run their own commands on the server without a password. Zimbra runs webmail and calendar for hundreds of millions of people, so a hacked server can expose everyone's email.

Severity
HighCVSS 3.1 · 8.9
Fix
Update available
Affected versions
before 10.1.20
Weakness
CWE-78OS Command Injection
Exploit likelihood
32% in 30 daysEPSS, higher than 98% of known flaws
Affects
Collaboration
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Aug 21, 2026
Federal fix deadline
Aug 24, 2026

How it works

An attacker sends a specially crafted email message to a Zimbra server that has SNMP monitoring notifications turned, and a flaw in how that feature reads the message lets the attacker's hidden commands run on the server as the Zimbra user.

What to do

Check whether the installed Zimbra version is older than 10.1.20. If it is older and SNMP notifications are enabled, you are exposed to CVE-2026-73570, and CERT Polska recommends checking logs for unexpected Zimbra service restarts and new files created by the zimbra user in /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ over the last 30 days.

Update Critical Zimbra through its normal update channel, then confirm the installed version matches the newest vendor release.

Technical details

Affected software: Collaborationby Zimbra

CVE-2026-73570 is a command injection vulnerability in the SNMP notification-processing component of Zimbra Collaboration Suite, caused by improper sanitization of untrusted input in SMTP requests. An unauthenticated attacker can send crafted SMTP requests to trigger arbitrary OS command execution as the zimbra user. Zimbra patched it in version 10.1.20, released July 20.

CERT Polska reports active exploitation and advises checking for unexpected zimbra service restarts and files dropped in webapps directories and /tmp over the prior 30 days. Shadowserver counts over 12,100 internet-exposed Zimbra servers, concentrated in Europe and Asia, though it cannot confirm how many are honeypots or already patched.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity High Attack depends on conditions outside the attacker's control
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L Open in FIRST.org calculator

References

View Original Source